feat(harmonyos): support account-confirmed watch provisioning

[wgqqqqq]

Summary

• fall back to the normal relay account login when the dedicated watch provisioning endpoint cannot mint a credential
• ask for account confirmation on the HarmonyOS phone and create a separate watch device token
• verify the returned account identity and master key before handing the credential to the watch
• keep the password ephemeral and add focused controller/state coverage

Verification

• pnpm run harmony:architecture
• HarmonyOS LocalTest via Hvigor
• signed HarmonyOS HAP build via Hvigor
• real HarmonyOS phone/watch provisioning flow and watch-to-desktop task flow

Remote scenarios

• Remote control: exercised with a physical HarmonyOS phone and watch connected to a BitFun desktop
• Peer device mode: credential handoff uses the existing distributed data channel
• Remote workspace and detached dispatch: not affected by this change